What’s Vulnerable › Vulnerabilities

CVE-2023-29006: Order GLPI plugin vulnerable to remote code execution from authenticated user

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-05 · updated 2026-06-17
• Weakness: CWE-502

Description

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin.

Affected products

• pluginsGLPI order: from 1.8.0 before 2.7.7; 2.10.0 — fixed in 2.7.7

How to fix

Upgrade to a fixed version: pluginsGLPI order 2.7.7. Check the vendor advisory for mitigations.

References

• https://github.com/pluginsGLPI/order/commit/c78e64b95e54d5e47d9835984c93049f245b579e
• https://github.com/pluginsGLPI/order/security/advisories/GHSA-xfx2-qx2r-3wwm
• https://github.com/pluginsGLPI/order/commit/c78e64b95e54d5e47d9835984c93049f245b579e
• https://github.com/pluginsGLPI/order/security/advisories/GHSA-xfx2-qx2r-3wwm

Get alerted when CVE-2023-29006 or the next vulnerability affects your stack